What we hold, why we are allowed to, and how to get rid of it

Who we are

tailorr is run by a sole trader, who is the data controller for everything described here. One person runs tailorr; there is no company behind it and no team.

Write to hello@tailorr.ink about anything on this page, including any of the rights below. It is the only address you need, and it reaches the controller directly.

We have not appointed a Data Protection Officer, and are not required to: sensitive data reaches us incidentally rather than as the point of the product, and the scale is small. That reasoning is recorded rather than the conclusion alone.

Where tailorr is offered

Accounts are offered to residents of the United Kingdom. Prices are in pounds, the terms are written for a UK resident, and we do not market tailorr anywhere else. If you are outside the UK, this is not being offered to you.

What we hold, why, and for how long

Everything below comes from you — typed in, pasted in, or read out of a CV you uploaded. We buy no data about you from anyone and we enrich nothing.

Your account

Your email address, a hash of your password, and whether the address has been verified. We hold it to give you an account at all, which is performance of our contract with you (Article 6(1)(b)). It lives as long as the account does and is hard-deleted when you delete the account, with no grace period.

Your profile

Employment and education history, free-text career detail, skills, nationality and clearance status, and your contact details as they should appear on a document. This is the material the documents are written from, so holding it is again performance of the contract — with one addition, below, for the sensitive parts of it.

Providing it is not optional in any practical sense: there is no document to write without it. It lives as long as your account does, except for what you remove or erase yourself.

A CV you upload

The file is not stored. Its text is extracted on our own machines, sent once to the AI provider so your details can be read into your profile, and discarded. The file is never written to storage and never logged.

What the read produces — the rows we are proposing to add to your profile — is held only until you act on it. It is deleted in the same operation that saves the rows you confirmed, and swept away after 30 days if you never come back to the review screen.

Applications and documents

The job listings you paste, what we worked out from them, and the documents we generated. These are the record of what you actually sent, so they last as long as the account does rather than expiring underneath you.

The prompts sent to the AI model and the responses that came back are not stored at all. There is no such record to disclose, to hand over, or to breach.

Payments

Stripe takes the payment and holds the card details; we never see them. We keep the credit transaction, and — as evidence if a payment is ever disputed — the IP address and browser user agent of the purchase, on a legitimate-interests basis (Article 6(1)(f)) for 180 days, for everyone.

We keep a financial record of your purchases for six years because tax law requires it — the amount, date, country and payment reference. It is no longer linked to your name, email, or anything from your CV.

Email, logs and analytics

We send four kinds of message: verify your email, reset your password, your export is ready, and — to the operator only — a daily digest. No email we send carries anything from your profile, in the body or as an attachment — every one is a notice plus a link into the app. We do not track whether you open them or click anything in them: there is no pixel and no rewritten link.

We keep sign-in and security logs, and error reports, to keep the app working and to detect abuse — a legitimate interest (Article 6(1)(f)). Error reports carry identifiers only: an allowlist rebuilds each event rather than filtering it, and a test asserts that profile prose, prompts, generated text and job listings cannot appear in one.

Product analytics are cookieless (see below), on the same legitimate-interests basis, and record which parts of the product get used rather than what you wrote in them.

How long, in one place

Sensitive information, and the consent it rests on

A career history carries special category data on its face without anyone intending it to. Regional Organiser, UNISON is a union membership. Youth Worker at a church is a religious belief. A gap you explain honestly may be a health condition.

We ask for none of it and we never infer any of it. The system is forbidden from classifying your free text as health, belief or union data — a classifier built to serve compliance would create exactly the processing it was meant to manage. You are the only one who decides which of your own details are sensitive.

Because it arrives anyway, we ask for your explicit consent to hold it — Article 9(2)(a) — as one separate, unticked checkbox when you first add anything, kept apart from accepting the terms. We record which wording you agreed to, so that if we ever change it we can tell who saw what.

You can withdraw it, and it is as easy as giving it. A setting erases every free-text entry on your profile in one action — deliberately over-broad, because the alternative is us guessing which of your sentences were the sensitive ones. Withdrawing does not close your account or destroy credits you paid for, and the next time you write something free-text we will simply ask again.

One honest limit on that lever: it clears the entries on your profile. If you pull it while you are part-way through reviewing a CV we have just read, the rows still sitting on that review screen are covered by the thirty-day sweep above rather than by the lever — finishing or abandoning the review clears them sooner.

Where we ask you to write something, we also ask you not to include health information, criminal record details, or information about other people. That request is the strongest protection available here and it is why it appears next to the box rather than in this document.

Other people you mention

A referee, a colleague, a manager, someone whose illness explains a gap — people named in your free text are data subjects too, and they have not agreed to anything. We ask you not to name them, we do not contact them, and we hold what you wrote only for as long as we hold the rest of your profile. If you are named in someone else’s profile and want that dealt with, write to the address above.

The AI, and what it is not shown

Your documents are written by AI models we reach through OpenRouter, which routes each request to Google Cloud’s European AI platform, where the model actually runs. Before your profile is sent, the values that identify you — your name and contact details, and the names of the organisations and projects in your history — are replaced with stable placeholders. The model reasons about what you did without being told where you did it.

This is pseudonymisation, and it is not anonymisation. We still hold your name and your employers’ names — that is what makes the placeholders resolvable when your document is rendered, and it is why everything here is still personal data with every right in this policy attached to it.

The boundary covers values in named fields, not the sentences you write. Prose reaches the model exactly as you typed it, so a description specific enough to identify where you worked identifies it, placeholder or no placeholder. The exact set of fields the boundary covers is enumerated on the Privacy page, where it is checked against the code on every change. It is not repeated here, because two lists is how one of them goes quietly wrong.

There is one exception, and it is the CV you upload: that text is sent once, whole, so your details can be read into your profile. You are told this beside the file picker before you choose, and you can decline it by typing your details in instead. The Privacy page explains what makes it the only one.

No AI provider stores your prompts, and we do not store them either. Nothing you give us is used to train anyone’s model.

Automated decisions

Nothing here makes a decision about you with legal or similarly significant effects. The models write a document and rate how well your own history evidences a requirement; no outcome is decided, no application is filtered, and a person — you — reviews everything before it goes anywhere.

Who else touches your data

Eight third parties process personal data on our instructions, each under a written data processing agreement. This is the whole list. Google Cloud Platform is engaged by Railway rather than by us, and is named here in its own right rather than described as somebody else’s infrastructure.

Amazon appears twice and is one company — sending email and storing documents are two different jobs, in the same account, in the same region, under the same agreement.

We update this list before a new processor starts, not after. If you want to be told when it changes, write to the address above.

Data leaving the UK

Each processor above names where it processes. Three of them are US-owned companies — Railway, Google Cloud beneath it, and Amazon — and we treat that as a real residual risk rather than something the region cancels out.

• Railway, and Google Cloud beneath it: a data processing agreement incorporating the Standard Contractual Clauses and the UK Addendum, with the project pinned to the Amsterdam region.
• Amazon Web Services: the AWS data processing agreement, which forms part of its standard terms, with a UK Addendum carrying both the EC Standard Contractual Clauses and the ICO’s International Data Transfer Addendum.
• OpenRouter, in the US: Standard Contractual Clauses (Module 2) plus the UK Addendum, incorporated into its data processing agreement. We have written a transfer risk assessment for it, and the transfer is per request with nothing retained. The model it routes to runs in the EU, so the AI processing itself is not a transfer out of the UK or EU.
• Stripe, in the EU and US: under Stripe’s own data processing agreement, as the merchant of record for your purchase.
• PostHog and Sentry process in the EU.

Cookies

There is no cookie banner here because there is nothing to ask you about. Our analytics are configured to store nothing at all on your device — no analytics cookie, no advertising cookie, no tracking across other sites, no session recording.

The one thing we do store on your device is what signing in requires: a cookie that keeps you signed in. It exists only to deliver the thing you asked for, which is why it needs no consent and why refusing it would mean not being able to log in.

Deleting things, in two different senses

“Delete” covers two actions with different weight here, so the product uses two words and so does this page.

• Remove is curation. The entry leaves your profile and stops being used, and documents that already cited it still make sense. It is the ordinary case and it is reversible.
• Erase permanently destroys the row. It also deletes any stored document whose text drew on it, and marks those applications as having had their documents removed. It is the action that withdraws your Article 9 consent over a particular entry, because an entry you merely removed is still data we hold. It is rare, explicit and warned about, and it lives behind the removed drawer so that reaching it takes intent twice.

Taking your data with you, and closing the account

Deleting your account is two deliberate steps: prepare your export, download it, then erase everything. We email you when the export is ready — a notice with a link into the app, never the file itself — and your account is still alive while you download it, which is the only way for the file to reach you without outliving the account it belongs to.

Then it is a hard delete, with no thirty-day grace period and no dormant account left behind. If you abandon the flow halfway, nothing is deleted. The export covers everything we hold, including what was generated for you, so one path serves both taking your data and asking for all of it.

What erasure reaches, and how quickly

Erasure reaches four places: our database, the document store, the analytics platform, and the email provider’s suppression list — the last because your address is the only thing the email provider keeps indefinitely, and leaving it there would be the same failure by a second door.

Your data is removed from live systems immediately and from backups within one month. That is a statement about the database. Our backup schedules are chosen so that no backup window is longer than a month — which is also the deadline we have to answer the request that erased it.

Generated documents are gone at once. The store holding them has no versioning, no backup layer and no replication, on purpose, so there is no second copy waiting to age out.

Two things survive an erasure, deliberately and in the smallest form we could find. The financial record described above, because tax law requires it. And a two-column note that a user was erased and when — without which we could neither prove we honoured your request nor stop a restored backup quietly resurrecting you.

One person can read your data

The operator has administrative access to production, including the ability to reconstruct what was sent to the model for a particular generation. That is the honest position for software run by one person who has to be able to diagnose a failed generation, and the basis is legitimate interests.

It is not unlimited and it is not unrecorded. Every such reconstruction writes a log row — who looked, whose data, which generation, and when. If you ask whether a human has read your data, that log is what makes the answer computable rather than a matter of assurance. The row survives your erasure, with its link to you severed, because otherwise the answer stops being computable for exactly the people most likely to ask.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing we do on a legitimate-interests basis. You can ask for your data in a portable form, and you can withdraw your Article 9 consent at any time without that affecting anything done before you withdrew it.

Most of these are buttons rather than requests to us. Editing your profile is rectification, the export is portability and access, and the two delete verbs above are erasure. Use them if you prefer — they are immediate. Otherwise write to hello@tailorr.ink and we will answer within one month.

Objecting to the analytics is a button too. On your account page you can unlink your usage from your account. We carry on recording and counting what happens, so what we know about how the product is used stays accurate — what stops is the attribution: the events no longer carry your account id, or anything else on them that could be exchanged for one, and each is recorded under a fresh random identifier used once and never again. It applies from the moment you press it. Events recorded before that stay as they are, and deleting your account is what erases those — it cannot reach an unlinked event, because by then there is nothing on one that says it was yours.

If you are unhappy with how we handled it, you can complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk. We would rather you told us first, but you do not have to.

Changes to this policy

When this page changes, the date at the top changes with it, and the list of processors above changes before a new one starts rather than after.

Where a change touches what you agreed to under Article 9, you are asked again — we record which wording each consent was given against, so a change that alters what is covered stops the old answer counting and the next thing you write asks you afresh. That is a mechanism rather than a promise to remember, which is the only kind of commitment worth making here.